Re: [TLS] Another IRINA bug in TLS

On Thu, May 21, 2015 at 9:48 AM, Nikos Mavrogiannopoulos
<nmav@redhat.com> wrote:
> On Thu, 2015-05-21 at 15:27 +0200, Aaron Zauner wrote:
>
>> I'm curious: what are instances where unsafe primes are still used,
>> generated and distributed for use in TLS? Hence where do we need to
>> deprecate?
>
> The "safe primes" is only a name. There are safe primes for DH that are
> not in the "safe primes" category. The primes used in DSA are such ones.

Why does it even matter? If everyone disabled ciphersuites that never
should have been used in the first place, we wouldn't be having this
conversation. Instead we're planning yet another patch.

We've decided that when responding to security issues, we'll throw on
more options, even when other alternatives exist, with the goal of
never scheduling depreciation. This increases implementation burden,
slows adoption, and ultimately harms security. Notice how we've kept
CBC mode alive by adopting RFC whatever it was, instead of instructing
everyone to move to AES-GCM, which has been out for 7 or so years. At
the same time we've not fixed known problems: logjam is only the
nastiest variation of problems caused by the signature on DH
parameters not indicating the ciphersuite.

Our thinking needs to be geared towards ending these problems.

>
> regards,
> Nikos
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.